Anthropic shipped Claude Opus 5.5 on September 22, cutting API pricing to $4/$20 per million tokens (down 40% from Opus 5) while claiming a jump to 66.4% on Terminal-Bench 4.0 — a benchmark whose independent public leaderboard still shows zero populated rows. It’s already the default model in Claude Code v2.1.280.
Grok 4.7 shipped September 21, nine days late, and landed simultaneously in GitHub Copilot, Cursor, and Devin. Cognition’s own benchmark disclosure says it scores below Grok 4.6 on aggregate because it keeps editing code nobody asked it to touch.
Foremerge, launched on Show HN September 21, has AI coding agents declare intent before touching code so it can catch semantic conflicts — one agent replacing a service while another extends it — that Git’s line-based diffing misses entirely. Apache 2.0, pre-1.0, single maintainer, no independent benchmarks yet.
Codex CLI 0.155.0 (Sept 17) added Touch ID verification for MCP tool-call requests in local TUI sessions on supported Macs, using the Secure Enclave. It’s a genuinely nice UX touch, and it only covers the one deployment mode — a human sitting at a keyboard — where MCP’s real exposure is already smallest.
Anthropic and Accenture announced a $1B, five-year embedded-evaluation partnership on September 18 — Accenture staff get ‘access comparable to an employee’s’ to observe Claude’s training and red-team it from the inside, non-exclusively, with more evaluator partnerships promised. It reads like a direct structural fix to the eval-vendor failure this blog covered in August.
Cognition shipped Code Scans on September 16: a plan/shard/map/reduce pipeline that turns a vague engineering goal like ‘cut our build time’ into a batch of pull requests. Cognition’s own numbers claim a 96% PR merge rate at Philips and a 64% Rust build-time cut — but the pipeline runs on SWE-2, a model post-trained on someone else’s base, the same open question this blog has been asking about Cognition since its Series E.
Claude Code v2.1.277 (September 18) added AGENTS.md as a fallback instructions file when no CLAUDE.md is present — a small changelog line that closes an interoperability gap Anthropic has had the standing to close since co-founding the Agentic AI Foundation last December. It also quietly doubles the blast radius of a supply-chain problem this blog has been tracking since April.
Air Security disclosed Plugin4Shell on September 17-18: a Git checkout flaw that lets a malicious plugin repository silently defeat SHA-pin verification across four major AI coding agents. Anthropic shipped a fix for Claude Code in June and OpenAI patched Codex in August — GitHub has no fix planned for Copilot, and Google is deprecating Gemini CLI instead of patching it.
Anthropic’s new R&D Automation Index puts a number on how much of its own AI research Claude actually leads: 26% as of August 2026, up from under 1% in February, with over 90% of measured work at least AI-collaborative and roughly 30,000 agents running concurrently. The most important number in the report is the one Anthropic didn’t round up: zero measured tasks where Claude operates fully autonomously.
Cognition engineer Eric Lu, working with multiple Devin agents, factored RSA-260 — a 260-digit number unsolved since the 1991 RSA Factoring Challenge — using a GPU-accelerated rewrite of the CADO-NFS sieving toolkit that Devin designed and operated with only periodic human steering. We independently re-multiplied and primality-tested the published factors ourselves: the claim checks out. RSA-2048 is unaffected.